Company [Company Name]

Document Audit Compliance Report

Classification Confidential

Version Control

Version Document Changes Last Modified By Date

0.1
[Company] : Audit Compliance Dashboard
Classification: Confidential

DATE:

AUDITOR:

Classification: Confidential

Inf or m a ti on Security Managem ent Sys tem Com pliance C ontr ols Com pliance

Compliant Observation
Observation Minor Nonconformity
Minor Nonconformity Major Nonconformity
Major Nonconformity Not Audited

Compliant Major Nonconformity

100% 100%

LEVEL OF COMPLIANCE NUMBER OF CONTROLS LEVEL OF COMPLIANCE NUMBER OF CONTROLS

Compliant 114 Compliant 0

Observation 0 Observation 0
Minor Nonconformity 0 Minor Nonconformity 114
Major Nonconformity 0 Major Nonconformity 0
TOTAL CONTROLS 114 TOTAL CONTROLS 114

Number of Controls Not Audited in this report: 0 Number of Controls Not Audited in this report: 0
 Classification: Confidential

[Company] : ISO 27001: 2013 Information Security Management System - Audit Sheet

Classification: Confidential

Evidence
ISO 27001 Clause Title Control Objective Rating Date Last Assessed Evaluation Method What needs to be put in place Who will put it in place Date it will be done
Positive Negative

4 Context of the organisation

Document: 2 Context of Organisation documents

The organisation shall determine external and internal issues that are relevant to its internal and external issues and was signed off by the
4.1 Understanding the organisation and its context purpose and that affect its ability to achieve the intended outcome(s) of its information Management Review Team Compliant Review of documents and records
security management system

Document: 2 Context of Organisation documents

The organisation shall determine: interested parties and their interests and was signed Compliant Review of documents and records
a) interested parties that are relevant to the information security management system off by the Management Review Team
Understanding the needs and expectations of interested
parties Document: 2 Context of Organisation documents
4.2
interested parties and their interests and was signed
b) the requirements of these interested parties relevant to information security. off by the Management Review Team Compliant Review of documents and records

Document: 3 Documented ISMS Scope documents the

The organisation shall determine the boundaries and applicability of the information scope and the bounderies and was signed off by the Compliant Review of documents and records
security management system to establish its scope. Management Review Team
Document: 3 Documented ISMS Scope documents the
When determining this scope, the organisation shall consider: scope and the bounderies and was signed off by the
Compliant Review of documents and records
Determining the scope of the information security
a) the external and internal issues referred to in 4.1 Management Review Team
management system
4.3 Document: 3 Documented ISMS Scope documents the
scope and the bounderies and was signed off by the
b) the requirements referred to in 4.2 Compliant Review of documents and records
Management Review Team

c) interfaces and dependencies between activities performed by the organisation, and Document: 3 Documented ISMS Scope documents the
those that are performed by other organisations. scope and the bounderies and was signed off by the
Compliant Review of documents and records
Management Review Team

The information security system is in place and

The organisation shall establish, implement, maintain and continually improve an evidenced and is high level described in document: 1
4.4 Information security management system information security management system, in accordance with the requirements of this Compliant Review of documents and records
The Information Security Management System
International Standard.

5 Leadership

Document: 1 Organisation Overview describes the

business and its objectives and mission and values.
Top management shall demonstrate leadership and commitment with respect to the
information security management system by:
Document: 1 The Information Security Management Compliant Review of documents and records
a) ensuring the information security policy and the information security objectives are System sets out the information security objectives.
established and are compatible with the strategic direction of the organisation

Infomration security policies are in place and process

b) ensuring the integration of the information security management system requirements are operating in line with the standard. Specific
Compliant Review of documents and records
into the organisation’s processes; evidence is provided against each control.

Document: 2 Information Security Roles Assigned and

Responsibilities sets out the roles and responsbilities
with allocated resource.
c) ensuring that the resources needed for the information security management system
Document: ISO RASCI Table assigns responsbility for Compliant Review of documents and records
are available;
each ISO 27002 / Annex A Control

Document: IS 06 Information Security Awareness and

Training Policy sets out the training and awarness and
evidence was seen of the operation.

SAMPLE - DETAIL REMOVED Document: Communication Plan sets out the Compliant Review of documents and records
communications for the year across media and
approaches

Document: 1 The Information Security Management

System sets out the objectives. These are managed and
reviewed at the Management Review Team meeting
which is documented in the document: 2 Information
Security Roles Assigned and Responsibilities.

The agenda template covers the requirements of the

standard and is seen to be in operation.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
year.
SAMPLE - DETAIL REMOVED Document: IS 15 Continual Improvement Policy sets Compliant Review of documents and records
out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

5.1 Leadership and commitment

Employment contracts and third party contracts
include coverage of information security requirements.

Document: Competency Matrix captures the core

competencies and training requirements of staff in
relation to information security

Document: IS 06 Information Security Awareness and

Training Policy sets out the training and awarness and
evidence was seen of the operation.
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: Communication Plan sets out the
communications for the year across media and
approaches

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log captures

and manages the corrective actions.

Document: Communication Plan sets out the

SAMPLE - DETAIL REMOVED communications for the year across media and Compliant Review of documents and records
approaches

Page 3 of 16
 Classification: Confidential

Document: 2 Information Security Roles Assigned and

Responsibilities sets out the roles and responsbilities
with allocated resource.

A Management Review Team is in place with

representatives from across the business.

Document: Competency Matrix captures the core

competencies and training requirements of staff in
relation to information security
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: Communication Plan sets out the
communications for the year across media and
approaches

Document: IS 01 Information Security Policy is the main

information security policy and is part of a framework
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
of policies.

Document: IS 01 Information Security Policy is the main

information security policy includes the Information
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Security Objectives

Document: IS 01 Information Security Policy is the main

information security policy includes the requirements
to meet legal and regulatory obligations.

Document: 4 Legal and Contractual Requirements

SAMPLE - DETAIL REMOVED Register sets out the legal, regulatory and contractual Compliant Review of documents and records
obligations

5.2 Policy Document: IS 01 Information Security Policy includes a

commitment to continual improvement.

SAMPLE - DETAIL REMOVED Document: IS 15 Continual Improvement Policy sets Compliant Review of documents and records
out the continual improvement policy.

The information security management system and

associated documents are available electronically to
SAMPLE - DETAIL REMOVED the organisation based on the persons role and Compliant Review of documents and records
business need.

Document: Communication Plan sets out the

communications for the year across media and
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
approaches

Documents are availble to intested parties based on

Non Disclosure Agreeements and Contracts being
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
place.

Document: 2 Information Security Roles Assigned and

Responsibilities sets out the roles and responsbilities
with allocated resource.

A Management Review Team is in place with

representatives from across the business.
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: Competency Matrix captures the core
competencies and training requirements of staff in
relation to information security

5.3 Organisational roles, responsibilities and authorities

Management Review Team is documented in the
document: 2 Information Security Roles Assigned and
Responsibilities and has responsibility for overseeing
the Information Security Management System. This
group reports to the board and has board
representation and certain board designated authority
SAMPLE - DETAIL REMOVED for decision making. The Management Review Team Compliant Review of documents and records
meeting at least quarterly and follow the agenda as
defined in the standard.

6 Planning

6.1 Actions to address risks and opportunities

Document: IS 04 Risk Management Policy describes the

risk management process.

Document: ISMS Risk Register captures, manages and

SAMPLE - DETAIL REMOVED reports risks. These are reported to and overseen by Compliant Review of documents and records
the Management Review Team.

Document: IS 04 Risk Management Policy describes the

risk management process.

Document: ISMS Risk Register captures, manages and

SAMPLE - DETAIL REMOVED reports risks. These are reported to and overseen by Compliant Review of documents and records
the Management Review Team.

Document: IS 04 Risk Management Policy describes the

risk management process.

Document: ISMS Risk Register captures, manages and

reports risks. These are reported to and overseen by
the Management Review Team.

Risk Management is part of the continual improvement

policy and process, document: IS 15 Continual
SAMPLE - DETAIL REMOVED Improvement Policy Compliant Review of documents and records
Continual improvement is managed, tracked and
reported using document: Incident and Corrective
Action Log

Document: IS 04 Risk Management Policy describes the

6.1.1 General risk management process.

Document: ISMS Risk Register captures, manages and

reports risks. These are reported to and overseen by
the Management Review Team.

Risk Management is part of the continual improvement

policy and process, document: IS 15 Continual
SAMPLE - DETAIL REMOVED Improvement Policy Compliant Review of documents and records
Continual improvement is managed, tracked and
reported using document: Incident and Corrective
Action Log

Page 4 of 16
 Classification: Confidential

Document: IS 04 Risk Management Policy describes the

risk management process.

Document: ISMS Risk Register captures, manages and

reports risks. These are reported to and overseen by
the Management Review Team.

Risk Management is part of the continual improvement

policy and process, document: IS 15 Continual
SAMPLE - DETAIL REMOVED Improvement Policy Compliant Review of documents and records
Continual improvement is managed, tracked and
reported using document: Incident and Corrective
Action Log

There is a risk managent process in place and

documented.

Document: IS 04 Risk Management Policy

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: ISMS Risk Register

There is a risk managent process in place and

documented.

Document: IS 04 Risk Management Policy

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: ISMS Risk Register

There is a risk managent process in place and

documented.

Document: IS 04 Risk Management Policy

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: ISMS Risk Register

Information security risk assessment

6.1.2
There is a risk managent process in place and
documented.

Document: IS 04 Risk Management Policy

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: ISMS Risk Register

There is a risk managent process in place and

documented.

Document: IS 04 Risk Management Policy

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: ISMS Risk Register

There is a risk managent process in place and

documented.

Document: IS 04 Risk Management Policy

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: ISMS Risk Register

There is a risk managent process in place and

documented.

Document: IS 04 Risk Management Policy

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: ISMS Risk Register

There is a risk managent process in place and

documented.

Document: IS 04 Risk Management Policy

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: ISMS Risk Register

There is a risk managent process in place and

documented.

Document: IS 04 Risk Management Policy

Document: ISMS Risk Register

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
All controls required are assessed and document in the
document: ISMS Risk Register

6.1.3 Information security risk treatment

Document: 6 Statement of Applicablity describes the
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
applicability of controls and why they are / are not
applicable.
There is a risk managent process in place and
documented.

Document: IS 04 Risk Management Policy

Document: ISMS Risk Register

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
All controls required are assessed and document in the
document: ISMS Risk Register

There is a risk managent process in place and

documented.

Document: IS 04 Risk Management Policy

Document: ISMS Risk Register

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
All controls required are assessed and document in the
document: ISMS Risk Register

Information security objectives and planning to

6.2
achieve them

Document: 1 The Information Security Management

System describes the information security objectives
SAMPLE - DETAIL REMOVED Compliant Review of documents and records

Document: 1 The Information Security Management

System describes the information security objectives
SAMPLE - DETAIL REMOVED Compliant Review of documents and records

Document: 1 The Information Security Management

System describes the information security objectives
SAMPLE - DETAIL REMOVED Compliant Review of documents and records

SAMPLE - DETAIL REMOVED

Document: Communication Plan sets out the Compliant Review of documents and records
communications for the year across media and
approaches
6.2.1 General
SAMPLE - DETAIL REMOVED
Is updated as part of the Continual Improvement policy Compliant Review of documents and records
and process and evidence as signed of by the
Management Review Team

SAMPLE - DETAIL REMOVED Documented in document: 1 The Information Security Compliant Review of documents and records
Managemen

SAMPLE - DETAIL REMOVED Documented in document: 1 The Information Security Compliant Review of documents and records
Managemen

Page 5 of 16
6.2.1 General

Classification: Confidential

SAMPLE - DETAIL REMOVED Documented in document: 1 The Information Security Compliant Review of documents and records
Managemen

SAMPLE - DETAIL REMOVED Documented in document: 1 The Information Security Compliant Review of documents and records
Managemen

SAMPLE - DETAIL REMOVED Documented in document: 1 The Information Security Compliant Review of documents and records
Managemen

7 Support

Document: 2 Information Security Roles Assigned and

7.1 Resources SAMPLE - DETAIL REMOVED Responsibilities sets out the roles and responsbilities Compliant Review of documents and records
with allocated resource.

Document: ISO RASCI Table assigns responsbility for

each ISO 27002 / Annex A Control

Document: Competency Matrix captures the core

competencies and training requirements of staff in
relation to information security
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: 2 Information Security Roles Assigned and
Responsibilities sets out the roles and responsbilities
with allocated resource.

Document: ISO RASCI Table assigns responsbility for

each ISO 27002 / Annex A Control

Document: Competency Matrix captures the core

competencies and training requirements of staff in
relation to information security
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: 2 Information Security Roles Assigned and
Responsibilities sets out the roles and responsbilities
with allocated resource.

Document: ISO RASCI Table assigns responsbility for

each ISO 27002 / Annex A Control
7.2 Competence

Document: Competency Matrix captures the core

competencies and training requirements of staff in
relation to information security
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: 2 Information Security Roles Assigned and
Responsibilities sets out the roles and responsbilities
with allocated resource.

Document: ISO RASCI Table assigns responsbility for

each ISO 27002 / Annex A Control

Document: Competency Matrix captures the core

competencies and training requirements of staff in
relation to information security
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Document: 2 Information Security Roles Assigned and
Responsibilities sets out the roles and responsbilities
with allocated resource.

Document: ISO RASCI Table assigns responsbility for

each ISO 27002 / Annex A Control

Employment contracts and third party contracts

include coverage of information security requirements.

SAMPLE - DETAIL REMOVED Document: Competency Matrix captures the core Compliant Review of documents and records
competencies and training requirements of staff in
relation to information security

Document: Communication Plan sets out the

communications for the year across media and
approaches

Document: IS 06 Information Security Awareness and

Training Policy sets out the training and awarness and
evidence was seen of the operation.

7.3 Awareness Document: Communication Plan sets out the

communications for the year across media and
SAMPLE - DETAIL REMOVED approaches Compliant Review of documents and records

Document: IS 06 Information Security Awareness and

Training Policy sets out the training and awarness and
evidence was seen of the operation.
Grievacnce and disciplinary policy and processes are in
place.

All policies include a statement on non conformance.

Document: Communication Plan sets out the

communications for the year across media and
approaches
SAMPLE - DETAIL REMOVED Document: IS 06 Information Security Awareness and Compliant Review of documents and records
Training Policy sets out the training and awarness and
evidence was seen of the operation.

Document: Communication Plan sets out the

communications for the year across media and
SAMPLE - DETAIL REMOVED approaches. It lays out what, when, who and how and Compliant Review of documents and records
records evidence.

Document: Communication Plan sets out the

communications for the year across media and
SAMPLE - DETAIL REMOVED approaches. It lays out what, when, who and how and Compliant Review of documents and records
records evidence.

Document: Communication Plan sets out the

communications for the year across media and
7.4 Communication SAMPLE - DETAIL REMOVED approaches. It lays out what, when, who and how and Compliant Review of documents and records
records evidence.

Document: Communication Plan sets out the

communications for the year across media and
SAMPLE - DETAIL REMOVED approaches. It lays out what, when, who and how and Compliant Review of documents and records
records evidence.

Document: Communication Plan sets out the

communications for the year across media and
SAMPLE - DETAIL REMOVED approaches. It lays out what, when, who and how and Compliant Review of documents and records
records evidence.

7.5 Documented information

Page 6 of 16
 Classification: Confidential

The information security system is in place and

SAMPLE - DETAIL REMOVED evidenced and is high level described in document: 1 Compliant Review of documents and records
The Information Security Management System.
Documents as described per each control.

7.5.1 General

SAMPLE - DETAIL REMOVED Compliant Review of documents and records

The information security system is in place and

evidenced and is high level described in document: 1
The Information Security Management System.
Documents as described per each control.

SAMPLE - DETAIL REMOVED Compliant Review of documents and records

Documents evidences as having the mark up included
SAMPLE - DETAIL REMOVED Documents appropriate to the organisation. Compliant Review of documents and records

7.5.2 Creating and updating

Documents are reviewed and signed of by the
SAMPLE - DETAIL REMOVED Management Review Team and evidenced as such. Compliant Review of documents and records
Documents are updated in line with document: IS 15
Continual Improvement Policy and the continual
improvement process

SAMPLE - DETAIL REMOVED Documents stored and accesbile appropriate to the Compliant Review of documents and records
organisation.

SAMPLE - DETAIL REMOVED Documents stored and accesbile appropriate to the Compliant Review of documents and records
organisation.

SAMPLE - DETAIL REMOVED Documents stored and accesbile appropriate to the Compliant Review of documents and records
7.5.3 Control of documented information organisation.

SAMPLE - DETAIL REMOVED Documents stored and accesbile appropriate to the Compliant Review of documents and records
organisation.
SAMPLE - DETAIL REMOVED Version control and document history in place. Compliant Review of documents and records

SAMPLE - DETAIL REMOVED Documents retained and dispoed in line with the Data Compliant Review of documents and records
Retention Policy.

8 Operation

The information security management system and

associcated processes are evidenced as being in place.
SAMPLE - DETAIL REMOVED Compliant Review of documents and records

Documents and version control are in place. Audit

plans are kept for a minimum of 1 year in line with the
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
retention policy.

SAMPLE - DETAIL REMOVED Document: IS 13 Change Management Policy Compliant Review of documents and records
8.1 Operational planning and control
Document: IS 14 Third Party Supplier Security Policy

A third party register is in place with periodic review

based on criticality, risk and business need.
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Current in date contracts are in place for all key
suppliers.

There is a risk managent process in place and

documented.

Document: IS 04 Risk Management Policy

Document: ISMS Risk Register

All controls required are assessed and document in the

document: ISMS Risk Register
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
8.2 Information security risk assessment
Risk assessment is performed at points of significant
change on introduction of new technology and at least
annually.

SAMPLE - DETAIL REMOVED Document: ISMS Risk Register Compliant Review of documents and records
There is a risk managent process in place and
documented.

Document: IS 04 Risk Management Policy

Document: ISMS Risk Register

All controls required are assessed and document in the

document: ISMS Risk Register
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
8.3 Information security risk treatment
Risk assessment is performed at points of significant
change on introduction of new technology and at least
annually.

SAMPLE - DETAIL REMOVED Document: ISMS Risk Register Compliant Review of documents and records

9 Performance evaluation

Document: 1 The Information Security Management

System sets out the objectives. These are managed and
reviewed at the Management Review Team meeting
which is documented in the document: 2 Information
SAMPLE - DETAIL REMOVED Security Roles Assigned and Responsibilities. Compliant Review of documents and records

The agenda template covers the requirements of the

standard and is seen to be in operation.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
year.

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

Page 7 of 16
 Classification: Confidential

Document: 1 The Information Security Management

System sets out the objectives. These are managed and
reviewed at the Management Review Team meeting
which is documented in the document: 2 Information
SAMPLE - DETAIL REMOVED Security Roles Assigned and Responsibilities. Compliant Review of documents and records

The agenda template covers the requirements of the

standard and is seen to be in operation.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
year.

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

Document: 1 The Information Security Management

System sets out the objectives. These are managed and
reviewed at the Management Review Team meeting
which is documented in the document: 2 Information
SAMPLE - DETAIL REMOVED Security Roles Assigned and Responsibilities. Compliant Review of documents and records

The agenda template covers the requirements of the

standard and is seen to be in operation.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
year.

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

Document: 1 The Information Security Management

System sets out the objectives. These are managed and
reviewed at the Management Review Team meeting
which is documented in the document: 2 Information
Monitoring, measurement, analysis and evaluation Security Roles Assigned and Responsibilities.
9.1 SAMPLE - DETAIL REMOVED Compliant Review of documents and records

The agenda template covers the requirements of the

standard and is seen to be in operation.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
year.

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

Document: 1 The Information Security Management

System sets out the objectives. These are managed and
reviewed at the Management Review Team meeting
which is documented in the document: 2 Information
SAMPLE - DETAIL REMOVED Security Roles Assigned and Responsibilities. Compliant Review of documents and records

The agenda template covers the requirements of the

standard and is seen to be in operation.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
year.

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

Document: 1 The Information Security Management

System sets out the objectives. These are managed and
reviewed at the Management Review Team meeting
which is documented in the document: 2 Information
SAMPLE - DETAIL REMOVED Security Roles Assigned and Responsibilities. Compliant Review of documents and records

The agenda template covers the requirements of the

standard and is seen to be in operation.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
year.

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.
Document: Incident and Corrective Action Log
captures and manages the corrective actions.

Document: 1 The Information Security Management

System sets out the objectives. These are managed and
reviewed at the Management Review Team meeting
which is documented in the document: 2 Information
SAMPLE - DETAIL REMOVED Security Roles Assigned and Responsibilities. Compliant Review of documents and records

The agenda template covers the requirements of the

standard and is seen to be in operation.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
year.

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

Page 8 of 16
 Classification: Confidential

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
SAMPLE - DETAIL REMOVED year. Compliant Review of documents and records

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
SAMPLE - DETAIL REMOVED year. Compliant Review of documents and records

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
SAMPLE - DETAIL REMOVED year. Compliant Review of documents and records

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
SAMPLE - DETAIL REMOVED year. Compliant Review of documents and records

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.
9.2 Internal audit
Document: Incident and Corrective Action Log
captures and manages the corrective actions.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
SAMPLE - DETAIL REMOVED year. Compliant Review of documents and records

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
year.
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Result of audits are reported to the Management
Review team.

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

" A program of internal audit is conducted and

document: Audit Plan sets out the audit plan for the
year.
SAMPLE - DETAIL REMOVED Compliant Review of documents and records
Result of audits are reported to the Management
Review team.

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions. "

The Management Review Team which is documented

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
in the document: 2 Information Security Roles
Assigned and Responsibilities meets at least quarterly.

Document: Managment Review Team Meeting Agenda,

the agenda template covers the requirements of the
standard and is seen to be in operation.

The Management Review Team which is documented

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
in the document: 2 Information Security Roles
Assigned and Responsibilities meets at least quarterly.

Document: Managment Review Team Meeting Agenda,

the agenda template covers the requirements of the
standard and is seen to be in operation.

The Management Review Team which is documented

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
in the document: 2 Information Security Roles
Assigned and Responsibilities meets at least quarterly.

Document: Managment Review Team Meeting Agenda,

the agenda template covers the requirements of the
standard and is seen to be in operation.

The Management Review Team which is documented

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
in the document: 2 Information Security Roles
Assigned and Responsibilities meets at least quarterly.

Document: Managment Review Team Meeting Agenda,

the agenda template covers the requirements of the
standard and is seen to be in operation.
9.3 Management review

Page 9 of 16
 Classification: Confidential

9.3 Management review

The Management Review Team which is documented

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
in the document: 2 Information Security Roles
Assigned and Responsibilities meets at least quarterly.

Document: Managment Review Team Meeting Agenda,

the agenda template covers the requirements of the
standard and is seen to be in operation.

The Management Review Team which is documented

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
in the document: 2 Information Security Roles
Assigned and Responsibilities meets at least quarterly.

Document: Managment Review Team Meeting Agenda,

the agenda template covers the requirements of the
standard and is seen to be in operation.

The Management Review Team which is documented

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
in the document: 2 Information Security Roles
Assigned and Responsibilities meets at least quarterly.

Document: Managment Review Team Meeting Agenda,

the agenda template covers the requirements of the
standard and is seen to be in operation.

The Management Review Team which is documented

SAMPLE - DETAIL REMOVED Compliant Review of documents and records
in the document: 2 Information Security Roles
Assigned and Responsibilities meets at least quarterly.

Document: Managment Review Team Meeting Agenda,

the agenda template covers the requirements of the
standard and is seen to be in operation.

10 Improvement

A non conformity occurs as a result of audit, incident or

observation.

SAMPLE - DETAIL REMOVED A program of internal audit is conducted and Compliant Review of documents and records
document: Audit Plan sets out the audit plan for the
year.

Document: IS 15 Continual Improvement Policy sets

out the continual improvement policy.

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

Document: IS 15 Continual Improvement Policy sets

SAMPLE - DETAIL REMOVED out the continual improvement policy. Compliant Review of documents and records

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

Document: IS 15 Continual Improvement Policy sets

10.1 Nonconformity and corrective action SAMPLE - DETAIL REMOVED out the continual improvement policy. Compliant Review of documents and records

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

Document: IS 15 Continual Improvement Policy sets

SAMPLE - DETAIL REMOVED out the continual improvement policy. Compliant Review of documents and records

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

Document: IS 15 Continual Improvement Policy sets

SAMPLE - DETAIL REMOVED out the continual improvement policy. Compliant Review of documents and records

Document: Incident and Corrective Action Log

captures and manages the corrective actions.

Document: IS 15 Continual Improvement Policy sets

SAMPLE - DETAIL REMOVED out the continual improvement policy. Compliant Review of documents and records
Document: IS 15 Continual Improvement Policy sets
Document:
out Incident
the continual and Corrective
improvement Action Log
policy.
captures and manages the corrective actions.
SAMPLE - DETAIL REMOVED Document: Incident and Corrective Action Log Compliant Review of documents and records
captures and manages the corrective actions.

10.2 Continual improvement SAMPLE - DETAIL REMOVED

Document: IS 15 Continual Improvement Policy sets Compliant Review of documents and records
out the continual improvement policy. A process of
continual improvement is in place and evidenced.

Compliant 114
Observation 0
Minor Nonconformity 0
Major Nonconformity 0
Not Audited 0

Page 10 of 16
 Classification: Confidential

[Company] : ISO 27001: 2013 ANNEX A / ISO 27002 - Audit Sheet

Classification: Confidential

Evidence
ISO 27002 Clause Title Control Objective SOC 1 General IT Control Rating Date Last Assessed Evaluation Method What needs to be put in place Who will put it in place Date it will be done
Positive Negative

5 Information security policies

5.1 Management direction for information security To provide management direction and support for information security in accordance with business requirements and relevant laws and regulations.

A set of policies for information security shall be defined,

5.1.1 Policies for information security approved by management, published and communicated to SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
employees and relevant external parties.

The policies for information security shall be reviewed at

5.1.2 Review of the policies for information security planned intervals or if significant changes occur to ensure SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
their continuing suitability, adequacy and effectiveness.

6 Organisation of information security

6.1 Internal organisation Objective: To establish a management framework to initiate and control the implementation and operation of information security within the organisation.

6.1.1 Information security roles and responsibilities SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

6.1.2 Segregation of duties SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

6.1.3 Contact with authorities SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

6.1.4 Contact with special interest groups SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

6.1.5 Information security in project management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

6.2 Mobile devices and teleworking Objective: To ensure the security of teleworking and use of mobile devices.

6.2.1 Mobile device policy SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

6.2.2 Teleworking SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

7 Human resource security

7.1 Prior to Employment Objective: To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered.

7.1.1 Screening SAMPLE - DETAIL REMOVED Control Environment SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

7.1.2 Terms and conditions of employment SAMPLE - DETAIL REMOVED Control Environment SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

7.2 During employment Objective: To ensure that employees and contractors are aware of and fulfil their information security responsibilities.

7.2.1 Management responsibilities SAMPLE - DETAIL REMOVED Control Environment SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

7.2.2 Information security awareness, education and training SAMPLE - DETAIL REMOVED Control Environment SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

7.2.3 Disciplinary process SAMPLE - DETAIL REMOVED Control Environment SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

7.3 Termination or change of employment Objective: Does the organisation ensure that employees, contractors and third party users exit the organisation or change employment in an orderly manner?

7.3.1 Termination or change of employment responsibilities SAMPLE - DETAIL REMOVED Control Environment SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

8 Asset management

8.1 Responsibility for assets Objective: To identify organisational assets and define appropriate protection responsibilities.

8.1.1 Inventory of assets SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

8.1.2 Ownership of assets SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

8.1.3 Acceptable use of assets SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

8.1.4 Return of assets SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

Page 11 of 16
 Classification: Confidential

8.2 Information classification Objective: Does the organisation ensure that information receives an appropriate level of protection?

8.2.1 Classification of information SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

8.2.2 Labelling of information SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

8.2.3 Handling of assets SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

8.3 Media handling Objective: Management of removable media

8.3.1 Management of removable media SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

8.3.2 Disposal of media SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

8.3.3 Physical media transfer SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9 Access control

9.1 Business requirements for access control Objective: To limit access to information and information processing facilities.

9.1.1 Access control policy SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.1.2 Access to networks and network services SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.2 User access management Objective: To ensure authorised user access and to prevent unauthorised access to systems and services.

9.2.1 User registration and de­registration SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.2.2 User access provisioning SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.2.3 Management of privileged access rights SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.2.4 Management of secret authentication information of users SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.2.5 Review of user access rights SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.2.6 Removal or adjustment of access rights SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.3 User responsibilities Objective: To make users accountable for safeguarding their authentication information.

9.3.1 Use of secret authentication information SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.4 System and application access control Objective: To prevent unauthorised access to systems and applications.

9.4.1 Information access restriction SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.4.2 Secure log­on procedures SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.4.3 Password management system SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.4.4 Use of privileged utility programs SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

9.4.5 Access control to program source code SAMPLE - DETAIL REMOVED Information Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

10 Cryptography

10.1 Cryptographic controls Objective: To ensure proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information.

10.1.1 Policy on the use of cryptographic controls SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

10.1.2 Key management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11 Physical and environmental security

11.1 Secure areas Objective: To prevent unauthorised physical access, damage and interference to the organisation’s information and information processing facilities.

Page 12 of 16
 Classification: Confidential

11.1.1 Physical security perimeter SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.1.2 Physical entry controls SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.1.3 Securing offices, rooms and facilities SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.1.4 Protecting against external and environmental threats SAMPLE - DETAIL REMOVED Environmental Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.1.5 Working in secure areas SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.1.6 Delivery and loading areas SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.2 Equipment Objective: To prevent loss, damage, theft or compromise of assets and interruption to the organisation’s operations.

11.2.1 Equipment siting and protection SAMPLE - DETAIL REMOVED Physical Security, Environmental Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.2.2 Supporting utilities SAMPLE - DETAIL REMOVED Environmental Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.2.3 Cabling security SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.2.4 Equipment maintenance SAMPLE - DETAIL REMOVED Environmental Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.2.5 Removal of assets SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.2.6 Security of equipment and assets off premises SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.2.7 Secure disposal or reuse of equipment SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.2.8 Unattended user equipment SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

11.2.9 Clear desk and clear screen policy SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

12 Operations security

Objective: Operational procedures and

12.1 Objective: To ensure correct and secure operations of information processing facilities.
responsibilities

12.1.1 Documented operating procedures SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

12.1.2 Change management SAMPLE - DETAIL REMOVED Change Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

12.1.3 Capacity management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

Separation of development, testing and operational

12.1.4 SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
environments

12.2 Protection from malware Objective: To ensure that information and information processing facilities are protected against malware.

12.2.1 Controls against malware SAMPLE - DETAIL REMOVED Physical Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

12.3 Backup Objective: To protect against loss of data.

Environmental Security, Computer Operations –

12.3.1 Information backup SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
Data Backups

Page 13 of 16
 Classification: Confidential

12.4 Logging and monitoring Objective: To record events and generate evidence.

12.4.1 Event logging SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

12.4.2 Protection of log information SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

12.4.3 Administrator and operator logs SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

12.4.4 Clock synchronisation SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

12.5 Control of operational software Objective: To ensure the integrity of operational systems.

12.5.1 Installation of software on operational systems SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

12.6 Technical vulnerability management Objective: To prevent exploitation of technical vulnerabilities.

12.6.1 Management of technical vulnerabilities SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

12.6.2 Restrictions on software installation SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

12.7 Information systems audit considerations Objective: To minimise the impact of audit activities on operational systems.

12.7.1 Information systems audit controls SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

13 Communications security

13.1 Network security management Objective: To ensure the protection of information in networks and its supporting information processing facilities.

Physical Security,Network Security, Data

13.1.1 Network controls SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
Communications

Physical Security,Network Security,Data

13.1.2 Security of network services SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
Communications

13.1.3 Segregation in networks SAMPLE - DETAIL REMOVED Physical Security,Network Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

13.2 Information transfer Objective: To ensure the protection of information in networks and its supporting information processing facilities.

Physical Security,Network Security, Data

13.2.1 Information transfer policies and procedures SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
Communications

13.2.2 Agreements on information transfer SAMPLE - DETAIL REMOVED Data Communications SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

13.2.3 Electronic messaging SAMPLE - DETAIL REMOVED Network Security, Data Communications SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

13.2.4 Confidentiality or non-disclosure agreements SAMPLE - DETAIL REMOVED Data Communications SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

14 System acquisition, development and maintenance

14.1 Security requirements of information systems Objective: To ensure that information security is an integral part of information systems across the entire lifecycle. This also includes the requirements for information systems which provide services over public networks.

Information security requirements analysis and

14.1.1 SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
specification

14.1.2 Securing application services on public networks SAMPLE - DETAIL REMOVED Network Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

14.1.3 Protecting application services transactions SAMPLE - DETAIL REMOVED Network Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

Page 14 of 16
 Classification: Confidential

14.2 Security in development and support processes Objective: To ensure that information security is designed and implemented within the development lifecycle of information systems.

14.2.1 Secure development policy SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

14.2.2 System change control procedures SAMPLE - DETAIL REMOVED Change Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

Technical review of applications after operating platform

14.2.3 SAMPLE - DETAIL REMOVED Change Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
changes

14.2.4 Restrictions on changes to software packages SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

14.2.5 Secure system engineering principles SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

14.2.6 Secure development environment SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

14.2.7 Outsourced development SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

14.2.8 System security testing SAMPLE - DETAIL REMOVED Change Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

14.2.9 System acceptance testing SAMPLE - DETAIL REMOVED Change Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

14.3 Test data Objective: To ensure the protection of data used for testing.

14.3.1 Protection of test data SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

15 Supplier Relationships
15.1 Information security in supplier relationships Objective: To ensure protection of the organisation’s assets that is accessible by suppliers.

15.1.1 Information security policy for supplier relationships SAMPLE - DETAIL REMOVED Vendor Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

15.1.2 Addressing security within supplier agreements SAMPLE - DETAIL REMOVED Vendor Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

15.1.3 Information and communication technology supply chain SAMPLE - DETAIL REMOVED Vendor Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

15.2 Supplier service delivery management Objective: To maintain an agreed level of information security and service delivery in line with supplier agreements.

15.2.1 Monitoring and review of supplier services SAMPLE - DETAIL REMOVED Vendor Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

15.2.2 Managing changes to supplier services SAMPLE - DETAIL REMOVED Change Management, Vendor Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

16 Information security incident management

Management of information security incidents

16.1 Objective: To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses.
and improvements

16.1.1 Responsibilities and procedures SAMPLE - DETAIL REMOVED Incident Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

16.1.2 Reporting information security events SAMPLE - DETAIL REMOVED Incident Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

16.1.3 Reporting information security weaknesses SAMPLE - DETAIL REMOVED Incident Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

16.1.4 Assessment of and decision on information security events SAMPLE - DETAIL REMOVED Incident Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

Page 15 of 16
 Classification: Confidential

16.1.5 Response to information security incidents SAMPLE - DETAIL REMOVED Incident Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

16.1.6 Learning from information security incidents SAMPLE - DETAIL REMOVED Incident Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

16.1.7 Collection of evidence SAMPLE - DETAIL REMOVED Incident Management SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

17 Information security aspects of business continuity management

17.1 Information security continuity Objective: Information security continuity should be embedded in the organisation’s business continuity management systems.

17.1.1 Planning information security continuity SAMPLE - DETAIL REMOVED Environmental Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

Environmental Security, Incident

17.1.2 Implementing information security continuity SAMPLE - DETAIL REMOVED Management,Computer Operations – Data SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
Backups

17.1.3 Verify, review and evaluate information security continuity SAMPLE - DETAIL REMOVED Environmental Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

17.2 Redundancies Objective: To ensure availability of information processing facilities.

17.2.1 Availability of information processing facilities SAMPLE - DETAIL REMOVED Environmental Security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

18 Compliance

Compliance with legal and contractual

18.1 Objective: To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements
requirements

Identification of applicable legislation and contractual

18.1.1 SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
requirements

18.1.2 Intellectual property rights SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

18.1.3 Protection of records SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

Privacy and protection of personally identifiable

18.1.4 SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity
information

18.1.5 Regulation of cryptographic controls SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

18.2 Information security reviews Objective: To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements

18.2.1 Independent review of information security SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

18.2.2 Compliance with security policies and standards SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

18.2.3 Technical compliance review SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED SAMPLE - DETAIL REMOVED Major Nonconformity

Compliant 0
Observation 0
Minor Nonconformity 0
Major Nonconformity 114
Not Audited 0

Page 16 of 16